When you outsource audits, do the firms you use normally assign a grade or rating to the review?

Our auditors assign an overall rating to each audit, Satisfactory, Adequate, etc.

Our outsourced audits assign a rating to each observation they identify and an overall rating to each audit performed.

Our outside audit firm does a risk rating on findings: low, medium and high

Ours also does low, medium and high.

Assigning a risk rating to findings or making a recommendation to management regarding an audit grade is one thing. Actually assigning a grade to audit implies an attestation, which you are not likely to get on internal audit work.

That was my thought, rlcarey. This was a recommendation by our examiners.

Thank you for your input.

I have been in many banks where internal audit assigns grades to the overall audit and to each issue identified. In those banks, the audits that were outsourced were done the same way.